bb44556fc33afc07fdfb3271c856507b2de90c8ca49adc6a93384a6737515a20

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe
Size 3.8MB
Sample261030-e1fbfahs3s
SHA256 bb44556fc33afc07fdfb3271c856507b2de90c8ca49adc6a93384a6737515a20
MD5 5530e20b2439ea4e5c09aba0fe2047cc
SHA1 251342c92487ac762f010aa499a6a3a7c7cbbca2
SHA512 9edada45ce6549acc1d5a0b1dc7324c6c912df5ad82a4bbe2318980c14d2255137e82f84d416faa1af3499614632bd5f5a5753ebb054cbb4cc56bd51ea6172c1
SSDEEP 49152:U+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+/:Up725p725p72CKa
TLSH
T106067E01FA8280B2E467017149AFD3BB4A75B9214F268ADFF38C536E5E337D0A631756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5676	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
4916	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
4276	svchost_CACCABCACBACACBBBBCBCBBCCABABABBACAABBABACBBBCABACACAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBCBAACBABCABBBBACACCCCBBBBCACBACBCBCABBACAABACCAABBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe"	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABABBCBABAABACBAAABACAACAAAACBCABACAACCBAAACACAACBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCABCACBACACBBBBCBCBBCCABABABBACAABBABACBBBCABACACAAB.exe"	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5984	sc.exe
5496	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2220	cmd.exe
1416	cmd.exe
1464	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCABCACBACACBBBBCBCBBCCABABABBACAABBABACBBBCABACACAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3396	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe
3396	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe
3396	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe
3396	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe
5676	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
5676	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
5676	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
5676	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
4276	svchost_CACCABCACBACACBBBBCBCBBCCABABABBACAABBABACBBBCABACACAAB.exe
4276	svchost_CACCABCACBACACBBBBCBCBBCCABABABBACAABBABACBBBCABACACAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3396	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	5676	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
Token: SeDebugPrivilege	4276	svchost_CACCABCACBACACBBBBCBCBBCCABABABBACAABBABACBBBCABACACAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 2220	3396	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe	91
PID 2220 wrote to memory of 1572	2220	cmd.exe	93
PID 5676 wrote to memory of 4940	5676	svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe	94
PID 3396 wrote to memory of 1416	3396	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe	95
PID 1416 wrote to memory of 5984	1416	cmd.exe	97
PID 3396 wrote to memory of 1464	3396	2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe	98
PID 1464 wrote to memory of 5496	1464	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_5530e20b2439ea4e5c09aba0fe2047cc_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCBCACABCBACBBCBBACCCBBBCABCCCCCACBCBCCCABCABCCBAABCBCCBCABCBCCACCABBCCBBCCAABABBAACAAAACCCBBCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCBCACABCBACBBCBBACCCBBBCABCCCCCACBCBCCCABCABCCBAABCBCCBCABCBCCACCABBCCBBCCAABABBAACAAAACCCBBCAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBAABCCBAACCBCABBBACBACABCCACAAACBABACBCCCACABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe" start= auto displayName= "UserDataSvc_CAABBAABCCBAACCBCABBBACBACABCCACAAACBABACBCCCACABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABBAABCCBAACCBCABBBACBACABCCACAAACBABACBCCCACABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe" start= auto displayName= "UserDataSvc_CAABBAABCCBAACCBCABBBACBACABCCACAAACBABACBCCCACABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABBAABCCBAACCBCABBBACBACABCCACAAACBABACBCCCACABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABBAABCCBAACCBCABBBACBACABCCACAAACBABACBCCCACABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCACBACACBBBBCBCBBCCABABABBACAABBABACBBBCABACACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABCACBACACBBBBCBCBBCCABABABBACAABBABACBBBCABACACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31c14aa76cf8319c907c9cf52c30c549cb53716ce12068934b8f0ce4f08d6029
MD5 2409e6766bff34c2ba7b91fea659a9bb
SHA1 70e0f51576c8c17f48bbf880c2fd06b1b24c3662
SHA512 7c8a54254642f23db82abc8244591aebc0577c435efd999c1696f331d1f0b9bd2d55e53386df7e16f2c07d076d3644c6c7244776540cef2a05266f29c9617b52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c5ef4a315b4af9c2ac8c76c42213f1961cce32d3a618fbe5c3f95124f831da1
MD5 2cec5dce7cddea621ba8fd42eb6dfc1b
SHA1 66213db32d5d3bfd3350b24825d9da58cc745cac
SHA512 f18ed017b04d404297b98ba7608d1d503d9c5c3599135e15f07446af83112c2568a6774d7b4ec06fa740b9b2bb7599e1c4852a7b2785dae57330100ec81b73c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e5fd437dafe2577315ef7e9d06bbabb3e2f4ac1fb4c781e0a5d273536f16fd0
MD5 c79603e1ffa6f822081f1ab0ff1a4975
SHA1 65f5bb729c38d3d0304fad7e079440bf6bdde3ac
SHA512 6d7c47e1ddf479ccec9378fd18a9edf65913f56948f153581721f4c0470b38de7a7e6684184c24386ecb6745d804dea4caf61ee913e459ecd5f487f3eca525fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa2a8ca1ee59476321a13fd0d35463792f08928952e86eeff0690eeef5393cda
MD5 8f2e88373f7e1f8b09d4603cbdbbd3ef
SHA1 ea027e5cc4217c704be8c863743cd9030c5e3569
SHA512 bde1bf198a72905f2d902e8122d598281dc5d77852e708fd8fe919fc5db8239554a6b3c4169a225b010bee97f695283097ea3f0fd5ae71c59dfba3c266693690
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dc9d372f468356746ad13f49076351590faff806f7d4e077bf0f21349fc489e8
MD5 2590db8101a77e2994695338b23f3f13
SHA1 84b9471931441cbc74a22d3a675c722a5aedbd50
SHA512 e68307d782df872dfb625aec13c584b92128b27e6b7be472e5fed0691f810cef037bc11a355fb3ce212623475c08f2b0ea20a1f891b0c2d5bab6c3ea2844d833
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 707da23e8ff25f41259eaffeea6dc62d7ff19a86fab473460fac003183d986f3
MD5 a8163a9010eac6d0bbabb8738cdda648
SHA1 f9059deef1e1357d440299733e34f0c2c094ff2a
SHA512 1a95221ca598030c7b3707025448567c01f86288ed7e1e3b0f63ac4d05ca535fcd63e8166c2235174cc8982dcf0ebf0528065ef849d1a421ffb244c2ecec11de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1b56fbe2444514391a9baaf280258101445d0b7c4362407a3b6d9201b65e88aa
MD5 ecbd4082ea176fa58ab97397d0962f37
SHA1 d63c97c40d697a77137f0350e55c5cd332fa335e
SHA512 17982dc592dbf1d2e0bfc5f23ef4aabb6e23e8747a476ea20d05f7414b8e99b576461023140834888e41456346d5a3eea689441a649418c5d9e7c7bb3ea92928
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7a627bc60ee7c61cbec16463e2628d20d6a2640aad9466b50eba7cc9eb8a6f93
MD5 6cabe29d7b7c34ce5903114942da6992
SHA1 c205156821980490fc51c15944ec71d45bddeccc
SHA512 39a5c34a7a78be9979ac90a467d2715aa16d714ab0797b0d11b0c28b064a2f066127018ce8ec25cba6486841bb4d2b2b711cce5e1d1bb1a0c85b987fa4229f36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1c0c5c0448d9aa45f2788cec1d4dd33bc95788e521afa5d43e6edf9db8e8bfdb
MD5 e6c7e5952d5aab4d6debc9a869cdb580
SHA1 cab184516d442756a5597abbd05667064dcdc57c
SHA512 d04dc104b6be95102b5dbb13df0211eca84661692bb658bd69f9b57f61650ae4d6c1261db0b7bed56b18dc9b60313786949fe5fa151fc2ffbcf9404144de0ea5
MD5 SHA1 SHA512

Submit Download

svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAABACBBCCABBCABABCABAAABACBACCBABCAACABACBABBABAA.exe
Size 3.8MB
SHA256 bb44556fc33afc07fdfb3271c856507b2de90c8ca49adc6a93384a6737515a20
MD5 5530e20b2439ea4e5c09aba0fe2047cc
SHA1 251342c92487ac762f010aa499a6a3a7c7cbbca2
SHA512 9edada45ce6549acc1d5a0b1dc7324c6c912df5ad82a4bbe2318980c14d2255137e82f84d416faa1af3499614632bd5f5a5753ebb054cbb4cc56bd51ea6172c1
SSDEEP 49152:U+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+/:Up725p725p72CKa
TLSH
T106067E01FA8280B2E467017149AFD3BB4A75B9214F268ADFF38C536E5E337D0A631756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 32e6f702a9857e3fc588a5b6b0fc1093b564ba0c8d5f4b95d1a490a316dbe6f5
MD5 ada8a1bb1ef8128544acae6d521e86aa
SHA1 0f36476b6f11d05cd25585314e3aa4ab8bd9b62d
SHA512 e26038376cbd3779dda4e5819865e7ee906fd0927a802a7badb8198baab4302de9e5dc76f837246de522a7743e70de8a3a7ccab5d3be31437aa504e2a7adf09a
TLSH
T13911B9B24055EC93E03065C36B3DCAC648BC3667A85C6AA86305D75CBB49C33CD590D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3396-6-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4276-72-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/4916-66-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/5676-22-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/5676-35-0x0000000000560000-0x0000000000581000-memory.dmp

Download